Skip to content
Agentic AI

intermediate · Interactive lab

Human Approval and Irreversible Actions

Approving everything and approving nothing fail the same way. What the rules already say, whether it can be undone, how wide it reaches and how often it happens decide it.

By the end: Separate what the rules already decide from what the agent is choosing.

Your challenge

Start here. This lab opens with every action automated, which is the wrong starting point and where an agent with tool access begins unless somebody decides otherwise. Two of these genuinely belong there. Two need a person because the rules already say so and the effect cannot be undone. Two are wide enough that the dry run is the only honest description of what they do. And one is not the agent's to do at any level of approval.

See it happen

Which of these needs a person

Approval: the agent may proceed
Slowed down so you can follow
SOURCE|+⟩and a coin in a boxBENCHDETECTORZ BASISanswers 0 and 1TALLYTHE QUBITTHE COIN
The agent proposes an action. The rules already say which of these it is, a person is who the rules may require, and what it changed is what nobody can take back.
  1. The agent → The rules
  2. The rules → A person
  3. The rules → What it changed
STEP 1 / 6

Two answers, both wrong

The agent proposes; The rules already have an opinion; A person is sometimes required; and What it changed is the part nobody can take back. Automating everything and asking about everything both fail, and they fail for different reasons.

Configure

Your decision for each action

For each action, decide how it should be taken. What the rules already say, whether it can be undone, how much it touches and how often it happens all decide it.

How should this action be taken?
Just do it
· In policy, undoable, and not worth anyone's attention.
Dry run, then do it
· Wide enough that it should be seen before it is made.
A person approves first
· The rules require it, or there is no second attempt.
Never through the agent
· Not permitted at all, at any level of approval.
  1. P-901 — Add a note to the ticket

    Deleted in one click, forty times a day.

    The action
    add a note to the ticket · reversible
    What the rules say
    allowed for this agent
    What it touches
    1 record · no dry run
    How often
    about 40 times a day
  2. P-902 — Apply the new price list

    Forty-eight thousand records, and a dry run exists.

    The action
    apply the new price list · recoverable
    What the rules say
    allowed for this agent
    What it touches
    48,000 records · a dry run would show exactly what changes
    How often
    about 1 time a day
  3. P-903 — Refund £4,200 to the customer

    The money leaves, and the rules already have a view.

    The action
    refund £4,200 to the customer · irreversible
    What the rules say
    a person must approve it
    What it touches
    1 record · no dry run
    How often
    about 3 times a day
  4. P-904 — Email 12,000 customers about the outage

    An email cannot be unsent, and this one is not permitted.

    The action
    email 12,000 customers about the outage · irreversible
    What the rules say
    not permitted at all
    What it touches
    12,000 records · no dry run
    How often
    rarely
  5. P-905 — Reset the password for a verified caller

    Already verified, recoverable, twenty-five times a day.

    The action
    reset the password for a verified caller · recoverable
    What the rules say
    allowed for this agent
    What it touches
    1 record · no dry run
    How often
    about 25 times a day
  6. P-906 — Change the bank details on a supplier record

    One record, and the next payment goes wherever it now says.

    The action
    change the bank details on a supplier record · irreversible
    What the rules say
    a person must approve it
    What it touches
    1 record · no dry run
    How often
    about 2 times a day
  7. P-907 — Apply a 10% discount to a customer segment

    Which customers are in the segment is the whole question.

    The action
    apply a 10% discount to a customer segment · recoverable
    What the rules say
    allowed for this agent
    What it touches
    3,400 records · a dry run would show exactly what changes
    How often
    about 1 time a day

What the rules say, whether it can be undone, how much it touches, and how often it happens. All four decide it.

Learn more

Why this pattern exists

Every agent that can change something needs an answer to this, and most teams pick one answer for everything. Automate it all, and the first irreversible mistake is also the first time anyone looks. Ask about it all, and within a fortnight approvals are being clicked through unread — including the one that mattered. Neither is a policy; they are both the absence of one. Four things separate these seven actions. What the organisation's rules already say, which is usually written down and not the agent's to reinterpret. Whether the effect can be undone. How many records it touches, and whether there is a way to see exactly which ones first. And how often it comes up, because frequency is what turns a reasonable safeguard into noise.

An agent working inside a support and billing operation has queued seven actions. Every row shows what the action is, what the organisation's rules already say about it, how much it touches, whether a dry run exists, and how often it comes up. What happened is shown after the decision.

  • Separate what the rules already decide from what the agent is choosing.
  • Tell an action that needs a person from one that needs a dry run, and one that needs neither.
  • Recognise approval fatigue as a failure with a cause, not a personality flaw.

The rule this lesson applies: Start with what is already decided. Most organisations have written down which actions a system may take on its own, which need a named person, and which nobody may do through automation at all — and an agent is not entitled to reinterpret any of that because it has better context. Where the rules say no, there is no approval that makes it yes; queuing a prohibited action for sign-off just moves an already-settled decision onto someone who is not entitled to reverse it. Where the rules say a person must approve, a dry run is not a substitute: it shows what would happen and then the agent does it anyway. What is left is the agent's judgement, and reversibility governs it. Something that can be undone in one call is cheap to get wrong, so asking about it costs more than it saves. Something irreversible is worth a person even when it looks small, because there is no second attempt. And something wide — thousands of records — is where a dry run earns its place: not approval, but the first accurate description of what the action would actually do, before it does it. One thing approval is not: evidence. A person clicking yes says the action was permitted, not that it happened, and an agent that reports the work approved and done without asking the system what actually changed has made the mistake this series spends a whole lesson on. Approval is a gate in front of the work; verifying the effect is a separate step behind it, and neither one substitutes for the other. The part teams consistently get wrong is frequency. An approval request for something reversible, routine and in policy, forty times a day, does not add a check; it trains the person to stop reading them.